Why It Matters

SEC377 flags path-specific GitHub Copilot instruction files when applyTo is present with the right shape but contains an invalid glob pattern.

This is useful because:

• Copilot path-specific instructions rely on applyTo to target files consistently
• an invalid glob can look valid in review while silently failing to match the intended files
• this stays a strict config-contract check with no prose heuristics

This rule lives in the explicit guidance lane because the issue is deterministic configuration quality and reviewability, not a headline exploit-style security claim.

Trigger Shape

• file path is .github/instructions/*.instructions.md
• frontmatter parses successfully
• applyTo is a string or list of strings
• at least one applyTo pattern fails deterministic glob compilation

Clean Cases

• applyTo: "**/*.rs"
• applyTo: ["**/*.rs", "**/*.ts"]
• fixture/test/example copies
• files already caught by missing/invalid-shape rules instead

Example Trigger

---
applyTo: "[unclosed"
---

Safer Example

---
applyTo: "**/*.rs"
---

How To Fix

• replace invalid applyTo patterns with valid globs
• keep path-specific Copilot instructions on reviewed, testable file patterns